Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentsCrypto Protocol Incident Forensics Agent
Transform blockchain logs and transaction hashes into evidence-linked incident reports and root-cause analyses.
$29.99
Crypto Protocol Incident Forensics Agent
Example session with this skill installed
Analyze the incident on Ethereum at block 19283746 involving the LiquiShield protocol. I've provided the TX logs for 0xabc...123 and the contract at 0xdef...456. Determine the root cause.
- Read your context and instructions
- Compiled the crypto protocol incident
The investigation into the LiquiShield protocol incident at block 19283746 is complete. The analysis focuses on the interaction between the Vault contract and the suspected attacker address.
Incident Forensics Report
| Event ID | Timestamp (UTC) | Reference (TX Hash) | Description | Status |
|---|---|---|---|---|
| E001 | 2024-05-12 14:02:11 | 0xabc...123 | Attacker calls deposit() with flash-loaned assets. | Observed |
| E002 | 2024-05-12 14:02:15 | 0xabc...123 | Vault.withdraw() triggered via fallback function. | Observed |
| E003 | 2024-05-12 14:02:20 | 0xabc...123 | Multiple Transfer events emitted before balance update. | Observed |
| E004 | 2024-05-12 14:02:22 | 0xabc...123 | Protocol total supply remains unchanged while assets exit. | Derived |
Root-Cause Hypotheses
Hypothesis 1: Cross-function Reentrancy
- Description: The
withdrawfunction lacks a non-reentrant guard and updates state after the external call. - Supporting Evidence: E002 and E003 show calls returning to the contract before state changes.
- Confidence: High
- Verification: Test
withdrawfunction in a hardhat fork with a malicious contract.
Hypothesis 2: Oracle Price Manipulation
- Description: Attacker manipulated the spot price of the collateral asset via the flash loan.
- Supporting Evidence: Significant price deviation noted in the
Syncevents of the paired pool. - Confidence: Medium
- Verification: Compare pool reserves before and after E001.
Prevention Roadmap
Implement ReentrancyGuard: Add OpenZeppelin nonReentrant modifier to all state-changing functions in Vault.sol. (Priority: High)
2.
Update State Before External Calls: Refactor withdraw to follow the Checks-Effects-Interactions pattern. (Priority: High)
3.
Integrate TWAP Oracle: Replace spot price dependency with a Time-Weighted Average Price to mitigate flash loan spikes. (Priority: Medium)
Next steps
- Provide the implementation code for the
Vaultcontract to confirm the reentrancy vector. - Share the traces for the secondary transaction hash to verify the oracle manipulation hypothesis.
- Review the proposed ReentrancyGuard implementation against the current deployment scripts.
Connects securely to your tools. The creator never sees your data.
About this skill
Post-mortem reports for DeFi exploits often suffer from fragmented data and speculative leaps. This skill provides a rigorous framework for converting raw transaction logs, contract addresses, and incident alerts into a structured, evidence-linked investigation. It forces a clear separation between observed facts and analytical hypotheses to ensure technical accuracy.
What it does
- Timeline normalization organizes disparate timestamps and block numbers into a chronological sequence of events.
- Transaction mapping tracks token movements, protocol calls, and cross-chain events linked directly to verified hashes.
- Contract auditing identifies implicated functions, proxy relationships, and roles based on supplied evidence.
- Root-cause analysis generates multiple hypotheses for vulnerabilities like reentrancy or oracle failures with specific confidence scores.
- Evidence categorization labels every claim as Observed, Derived, or Hypothesis to prevent unfounded assumptions.
How it works
- Intake where you provide transaction hashes, contract addresses, and incident windows.
- Reconstruction of the attack flow using normalized evidence and transaction mapping.
- Hypothesis generation to test various vulnerability vectors against the available data.
- Final Reporting including an executive summary, evidence register, and prevention roadmap.
Frameworks & tools
Works with raw EVM transaction logs, Etherscan exports, Tenderly traces, and protocol documentation. It is designed for blockchain security researchers and incident response teams.
Why this beats prompting it yourself
Generic prompts often hallucinate attacker intent or miss subtle contract interactions. This skill enforces strict evidence-linking and confidence labeling, ensuring that your final report stands up to technical scrutiny without jumping to conclusions.
Use cases
- Analyze a protocol exploit to identify the specific reentrancy or logic error used.
- Map complex token flows across multiple contracts and addresses post-incident.
- Create a prevention roadmap with mapped controls for dev teams.
- Document evidence for insurance or stakeholder reporting.
Known limitations
Does not have live blockchain access; requires manual input of transaction data. It cannot verify legal liability or identity.
Requires manual input of transaction data and logs; no live chain access. Does not verify legal liability or attacker identity.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 22 days ago
Permissions
No special permissions declared or detected